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Executive Summary 


This reliability study was performed in order to provide the aviation community 
with an estimate of Complex General Aviation (GA) Aircraft System reliability. To 
successfully improve the safety and reliability for the next generation of GA aircraft, a 
study of current GA aircraft attributes was prudent. This was accomplished by 
benchmarking the reliability of operational Complex GA Aircraft Systems. Specifically, 
Complex GA Aircraft System reliability was estimated using data obtained from the 
logbooks of a random sample of the Complex GA Aircraft population. 

The approach used to estimate the current reliability of Complex GA Aircraft 
Systems included the following: 

1. Define benchmark from population of GA aircraft (i.e., Complex GA 
Aircraft). 

2. Define Complex GA Aircraft Systems. 

3. Identify source of failure data. 

4. State ground rules and assumptions. 

5. Collect data for a random sample of Complex GA Aircraft population. 

6. Analyze data to identify proper distribution that models failure data. 

7. Perform goodness-of-fit and bias tests to validate distribution fit and verify 
sample randomness. 

8. Estimate distribution parameters, system reliability, and system hazard rates. 

The results of this analysis provide insight into the current reliability of Complex 
GA Aircraft Systems. All of the reliability estimates shown below were based on a six- 
hour flight. In addition, a ninety-five percent confidence was used to estimate the 
reliability of the Airframe, Electrical, Powerplant, Flight Control and Ground Control 
Systems. The Cockpit Instrumentation reliability estimate was performed in an earlier 
report that is included in Appendix A. All system Reliability estimates are as follows: 


System 

Reliability Estimate 



Airframe 

0.99940 

Electrical 

0.99997 

Powerplant 

0.99986 

Flight Control 

0.98476 

Ground Control 

0.99598 

mrnmmmmmmm 

0.976 


In this report, the Weibull distribution (two-parameter, p and a) was used to 
estimate Complex GA Aircraft System reliability. The goodness-of-fit tests and the bias 
tests performed indicate that the Weibull distribution best fits the aircraft data for these 
systems and that the sample used is not significantly biased. The results indicated that 
the random sample of aircraft used, along with the Weibull distribution, was appropriate 
for estimating the system reliabilities for the Complex GA Aircraft population. 
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I. Introduction 


This report presents the results of a study in which the current reliability of 
General Aviation (GA) Aircraft Systems was estimated. This report was prepared for the 
NASA Langley Research Facility’s Office of Safety and Mission Assurance (OSMA). 
The results of this assessment provide insight into current general aviation reliability and 
may be used to assist in the development of future GA aircraft reliability and safety 
requirements. 

II. Background 


The current reliability of Complex GA Aircraft Systems is unknown. The ability 
to gain insight into this unknown will provide the aviation community with a valuable 
benchmark that will assist in the development of reliability and safety requirements for 
future aircraft. This benchmark must be established in order to ensure that technology 
development, design guidelines, and work on certification standards progresses towards 
the effective goal of affordable technologies for small single engine airplanes. This is a 
key issue to revitalizing the next generation of general aviation aircraft. The effect of a 
successful, safe, and reliable product will make general aviation aircraft in the United 
States accessible to a majority of the population. In order to meet this goal, insight into 
the current reliability of general aviation aircraft is required. 

This report covers what is termed Complex GA Aircraft Systems and represents 
the compilation of several reliability studies involved with determining the reliability of 
these systems (i.e.. Airframe, Cockpit Instrumentation, Control, Electrical, and 
Powerplant Systems). 

III. Statement of Problem 

The goal of this study was to assess the current reliability of Complex GA 
Aircraft Systems. In order to provide relevant information regarding GA aircraft 
reliability that is conducive to the engineering goal of ensuring development of an 
affordable, advanced single pilot transportation aircraft, it is necessary to include 
airplanes that share many of the characteristics of future aircraft design. 

The proposed future aircraft design will consist of an aircraft with a cruise speed 
of 160 knots and a range of 700 nm. This aircraft is considered to be a single pilot, four- 
place, light-single engine piston aircraft with near all weather capability. Complex GA 
Aircraft have retractable landing gear, flaps, and a constant-speed propeller. The systems 
of the future aircraft will be very similar to current Complex GA Aircraft Systems and 
therefore, represent the population of GA aircraft used in this study. Where the futuristic 
airplane model did not provide guidance into design complexity or definition, typical 
Complex GA Aircraft architecture was assumed. 
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IV. Approach 


The approach used in performing the reliability study was to define the Complex 
GA Aircraft Systems and Subsystems for complex aircraft, collect failure data from a 
random sample of complex aircraft, and then analyze the data in order to determine 
reliability estimates. To accomplish this, Complex GA Aircraft were divided into the 
following five systems indicating primary function: 

Airframe - any component or structure that is essential to the structural integrity of the 
aircraft. Even though they aren ’t considered part of the structural integrity of the 
aircraft, the interior upholstery, the aircraft paint and the static wicks are also part 
of the Airframe System. 

Cockpit Instrumentation - the minimum instrumentation required for general aviation 
aircraft flying under IFR conditions as defined in Federal Aviation Regulations 
(FAR) Part-91 (see Appendix A). 

Control - any component that controls the aircraft’s attitude, heading, and altitude or 
changes the aerodynamic characteristics of the aircraft in the air or on the ground 
(excluding powerplant). This system is composed of two primary systems, Flight Control 
and Ground Control. 

Electrical - the lighting system and any components involved in the source and 
distribution of electrical power. 

Powerplant - any component or system that is essential to developing thrust for the 
aircraft. (The only exception to this is the inclusion of the heating and ventilation system 
under Powerplant). 

The subsystems were also delineated by function; that is, a system performs a 
single independent function. The following sections describe the subsystems and the 
process in detail with the exception of the Cockpit Instrumentation System. The report 
and methodology used to estimate the reliability of the Cockpit Instrumentation System is 
found in Appendix A. 


A. Airframe System 

1. Wing 

The Wing subsystem is any component or structure that is part of the wing, the 
fuselage carry-through, or any structure that directly supports the wing (i.e. wing struts). 
This does not include the control surfaces on the trailing portion of the wing or any 
components or structures that are SOLELY utilized by the fuel system (See Figure 1). 
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Figure 1 - Exploded Wing Diagram 


2 . Empennage 

The empennage is any fixed part of the airframe that is aft of the last row of seats. 
This includes the baggage compartment, the tail cone and any fixed tail surfaces. The 
movable control surfaces are part of the Aircraft Control System. 

3. Cabin Fuselage including Engine Structure 

The fuselage is considered to be any component or structure that contributes to 
the structural integrity of the aircraft forward of the last row of seats and is not considered 
part of the wing subsystem. It includes the doors, engine mount and cowling, and the 
windshields and windows, instrument panel shock mount, and any other miscellaneous 
structure not associated with the wing subsystem. 

4. Upholstery 

This subsystem is mainly concerned with the furnishings in the cabin (carpet, 
trim, etc.). All components in this subsystem are considered non-structural. 

5. Seats 

The seats subsystem concerns any component that connects the pilot, co-pilot, or 
passengers to the airframe. This includes any component that is a part of the pilot’s, co- 
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pilot’s, and passenger’s seat or any supporting components such as the seat rails, the seat 
belts, and any adjustment mechanisms. 

6. Electro-Static Discharge (ESD) 

The ESD system on most aircraft is simply just the system of static wicks placed 
about the airframe. A static wick is a small flexible device that dissipates the static 
charge that often accumulates on an aluminum airframe traveling through charged air. 
This discharge effectively increases the transmitting and receiving range of the aircraft’s 
electronics and also reduces the risk of a lightning strike (See Figure 2). 



Figure 2 - Static Wicks (#33) on the Rudder (Cessna 210 Illustrated Parts Manual 1 ) 

7. Exterior Coatings 

This system concerns all paints, lacquers, or inhibitors applied to the exterior skin 
of the aircraft. These coatings usually serve a dual purpose; they serve to protect the skin 
from abrasive elements such as dust or corrosion, and they also serve an aesthetic 
purpose. 


B. Flight Control System 

The Flight Control System (FCS) of most Complex GA Aircraft is made up of six 
independent subsystems: longitudinal control, lateral control, directional control, flaps, 
trim, and at least a single-axis autopilot and are remarkably similar to the proposed future 
aircraft design. With the exception of Mooney aircraft, most complex aircraft have a 
relatively simple cable-operated system. The aircraft flaps are mostly electrically 
operated and are assumed to be of the Fowler-type. The longitudinal, lateral, and 
directional control system are mostly cable-operated utilizing bellcranks and push-pull 
rods; however, data was collected on the entirely push-pull rod systems, specifically 
those employed on Mooney aircraft. 
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1. Longitudinal Control System 

A control column connected to a cable operates the longitudinal control system. 
The elevator/stabilator cable operates, through a series of pulleys, a bellcrank at the rear 
of the plane. This bellcrank is attached to the elevator spar, which then rotates the 
elevator/stablilator (See Figure 3). 



Figure 3 - Diagram of a typical longitudinal control system (Cessna 210 Illustrated Parts Manual 1 ) 

2. Lateral Control System 

The lateral control system is similar in its operation to the longitudinal control 
system. The control column is again connected to a cable, which through a series of 
pulleys is connected to a bellcrank in each wingtip. The bellcrank operates a push-pull 
rod that moves the actual surface (See Figure 4). 



Figure 4 - Diagram of a typical lateral control system (Cessna 210 Illustrated Parts Manual') 
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3. Directional Control System 


The directional control systems in most aircraft are very akin to each other as 
well. The rudder pedals actuate a cable that, through a series of pulleys, operates a 
bellcrank at the base of the rudder (See Figure 5). 



Figure 5 - Diagram op a typical directional control system (Cessna 210 Illustrated Parts Manual 1 ) 

4. Flap system 

The flap system on most aircraft is electrically operated. There is a control switch 
in the cockpit that actuates an electric motor, usually connected to a jackscrew that moves 
a push-pull rod connected to the flap. There is a cable system that connects the two flaps 
together and insures synchronized operation. 

5. Trim system 

The aircraft covered in this study have, for the most part, electrically actuated 
pitch trim. The system is mainly composed of a electric trim switch, usually located on 
the yoke or the instrument panel, that leads through a circuit breaker to an electric 
actuator in the tail or belly of the aircraft. This actuator moves either the cables 
associated with a trim tab/stab ilator, or powers the surface directly. 

6. Basic autopilot 

The basic autopilot is a single-axis system consisting of a main frame, directional 
gyro, pitch and altitude sensing units, accelerometer, solid state pressure transducer, and 
servo actuators. This type of system is designed to function as a wing leveler, that is; it 
keeps the wings level, preventing the aircraft from banking either right or left. 
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C. Ground Control System 


The Ground Control System (GCS) includes any system of the aircraft that 
control the airplane’s heading and speed on the ground, excluding the power plant. Since 
the future will bring retractable landing gear into more aircraft, it is desirable to include 
the reliability of current retractable landing gear rather than fixed gear. For our study, on 
a Complex GA Aircraft, the ground control system consists of three subsystems; the 
landing gear (including the cockpit switches); the hydraulic system (that includes the 
brakes); and the ground steering system (defined to include components from the pedals 
to the steering boots). 

1. Landing Gear 

The landing gear subsystem includes all structure that is exclusively used by the 
landing gear, the wheels, the tires, and all associated switches, controls, or systems for 
extending and retracting the gear. On some aircraft, the extension and retraction of the 
gear also invokes a hydraulic system. However, this is usually an independent system 
and will be treated as such. 

2. Hydraulic System 

The hydraulic system includes all hoses, joints, and reservoirs associated with 
providing hydraulic pressure to the brakes, the brakes themselves, the brake pedals, and 
the parking brake assembly. 

3. Ground Steering System 

The ground steering system includes the rudder pedals, any associated rods that 
connect the rudder pedals to the nose gear, and the steering collar on the nose gear itself 
(See Figure 6). 



Figure 6 - Ground Steering System i or the Cessna 2 1 0 (Cessna 210 Illustrated Parts Manual) 
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D. Electrical System 


1. Lighting 

The lighting system is comprised of all light fixtures and their immediate 
components on the aircraft. The break point is any component whose sole purpose is to 
provide electricity to a light fixture. Any other wires or power packs that power more 
than just lights are part of the Source and Distribution System. 

2. Source and Distribution 

The Source and Distribution system includes any component that is involved in 
producing or providing electrical power to systems on the aircraft. This includes the 
battery, the alternator, and any wiring that is common to more than one system. If wiring 
or power packs are exclusive to a particular subsystem, such as the hydraulic power pack, 
it is not considered part of the Source and Distribution system. 


E. Powerplant System 

1. Engine 

The engine subsystem contains all components that are strictly part of the 
aircraft’s engine. This includes all the elements of the engine block and exhaust system 
including the magnetos. However, the alternator and engine-driven fuel pump are not 
included; those components go in the electrical system and fuel subsystem, respectively. 
The crankshaft is included, however, the constant-speed mechanism in the propeller is the 
cut-point between the propeller and engine subsystems (See Figure 7). 

Figure 7 - Cessna 2 1 0 Engine (Continental IO- Figure 8 - Piper PA-28R-201 Fuel System 

520)' 
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2. Fuel 


The fuel system includes any component that contributes to providing fuel 
through the engine-driven fuel pump. This includes any fuel tanks (if integral, they were 
included in both airframe and fuel systems), and fuel tank related equipment in the tanks 
(e.g. sumps) except for any fuel quantity transmitting equipment. It includes any fuel 
lines, fuel cutoff switches, fuel filters, tank switches, and fuel boost pumps (including the 
on/off switch) (See Figure 8 above). 


3. Heating and Ventilation 

The heating and ventilation system incorporates all elements that control the 
temperature or the flow of air in the passenger cabin. This subsystem includes all scat 
tubes leading from the engine or exhaust systems, outside air vent and their respective 
plumbing, and the cockpit controls to regulate the temperature. However, while some of 
the aircraft in the sample were equipped with air-conditioning, these components were 
not considered part of the “typical” aircraft and therefore not included in this analysis 
(See Figure 9). 



Figure 9 - Heating and Ventilation System for a Cessna 210 1 

4. Propeller 

The propeller includes any components that are involved in translating the 
engine’s torque into thrust. This includes the pitch control mechanism, the spinner, the 
propeller itself, and any attachment hardware. 
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F. Data Collection 


In order to determine the reliability of Complex GA Aircraft Systems, a method 
of collecting failure data was required. A particular note of interest is that estimating the 
reliability of a single aircraft manufacturer or specific type was not the intent of this 
study. Rather, estimating the current reliability of Complex GA Aircraft Systems in 
general was specified. After researching many data sources and collection methods, it 
was determined that failure data obtained from operational aircraft would provide a good 
benchmark of current system reliability and that logbooks of complex aircraft could 
provide the source of this failure data. The logbooks, required by law to be kept by 
aircraft owners, are reviewed by the Federal Aviation Administration (FAA) and cover 
the history of maintenance performed on the aircraft. Work performed on the aircraft is 
logged in these books and is signed by the mechanic who performed the work. This 
provides a good source of historical data regarding airplane component failures and 
replacements. It is also important to note at this time that “catastrophic failures” are not 
included in these records for obvious reasons and are not considered in this report. 

The next step was to sample the population of Complex GA Aircraft. There are 
ways of assuring that the selection of a sample is indeed a random sample. Ideally, each 
item in a population would have the equal probability of being selected. In the sampling 
of Complex GA Aircraft this would entail identifying and including every aircraft ever 
built that fits the definition of a Complex GA Aircraft. Even if every aircraft that fits this 
description could be included, owner participation would have to be guaranteed. This 
was found to be unachievable. In addition, any aircraft randomly selected may have been 
involved in a catastrophic accident. In this case, legal methods may have been required 
in order to obtain aircraft documentation. In situations like these, a relatively haphazard 
selection method may be invoked, if it is believed that this method will not seriously 
violate the assumption of randomness'. The method used to obtain a random sample of 
the Complex GA Aircraft population is described below. 

The random sample used for data collection was obtained by contacting flight 
schools and aircraft owners, and aircraft associations. In all cases it was made clear that 
any data obtained would be collected in confidentiality and that aircraft numbers, owner 
names, and specific aircraft failures would not be divulged beyond those individuals 
collecting the data. Flight schools were called directly and for practical purposes 
consisted mostly of local flight schools. However, data was also collected from flight 
schools outside of the local area and by door-to-door contact. By contacting aircraft 
owner associations, members were solicited from the head of the association directly in a 
newsletter. This provided all members with the opportunity to participate in the study 
while broadcasting this request nationwide. 

To summarize, it was not known whether members would participate or not - nor 
was it known which complex aircraft would be included or how many aircraft would be 
obtained from each source. Through this relatively haphazard selection method of data 
collection defined above, it was believed that a random sample representative of the 
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Complex GA Aircraft population was obtained and was shown to be the case in Sections 
V.A., V.B., V.D., and VE. 

1 Ground Rules and Assumptions 

As in any analysis, no two individuals will perform a specific analysis identically 
(e.g.. Fault Tree). The following ground rules and assumptions are defined so that a 
knowledgeable person can reproduce the results presented in this study. They identify 
constraints placed on the process allowing an accurate estimate of Complex GA Aircraft 
reliability, which is the primary purpose of this study. They also define failure, isolate 
factors from the analysis that may obscure hardware failure, and aid in simplifying the 
analysis. Although no two analysts will perform an analysis the same way, it is believed 
that the basic ground rules and assumptions used would not grossly deviate from those 
presented here. In this analysis, failure occurs when the inherent ability of a component 
to perform its intended function is lost and therefore could lead to a loss of an aircraft’s 
system/subsystem function. Another way to look at failure for this analysis is any 
component failure that places the aircraft and pilot in a state of “elevated risk.” Based on 
this concept, there were a number of ground rules and assumptions made to facilitate the 
collection of data and the accuracy of the results. These include: 

^ Only deal with “failures”, not mandatory preventative maintenance or minor 
repairs where no components were replaced, examples are: 

1. Using the method of “ stop-drilling (i.e., drilling a hole at the end of a 
crack to remove stress, thus preventing additional crack propagation along 
the initial path) for a cracked fairing, would not be considered a failure until 
the fairing was replaced 

2. Replacing tires due to low tread or wear is not a “failure however, if the 
tires explodes or goes flat while in flight operations, then it is considered a 

failure 

3. An oil change is considered preventative maintenance and is not included 

4. Sen’icing of a battery. 

^ Bushings, shims, or components whose function is to wear, are not considered 
failures 

S Regularly replaced items, those meant to wear and/or fail after a certain period of 
time, (i.e. lightbulbs, bushings, etc.) are not included in the analysis. 

'U No turbo-related components 

S Any probes, gauges, or transmitters whose purpose is to provide information to 
the pilot are not included in this system. (This also includes the vacuum system.) 

S Failures due to an improper part are not included 
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■S Human induced failures are not included 


■S Missing parts are not considered failures (e.g., rivets, screws, bolts) 

•S Anything below the subsystem level is considered to be in series 

✓ Failure/replacement due to mechanic’s poor skills/procedures not included 

S All systems are independent (i.e., loss of one subsystem does not result in loss of 
another subsystem function). 


G. Data Analysis 

The method selected for estimating the reliability of the GA Aircraft Systems was 
to first determine the proper distribution that models the collected failure data for each 
subsystem. This was accomplished by placing the failure data collected from the total 
number of aircraft sampled into a database and separating them according to the defined 
subsystems. By constructing probability plots (See Section V.C.2.) for each subsystem, 
distributions that describe the failure process can then be obtained. This information can 
then be used to determine the distribution parameters and identify confidence bounds. 
This method was preferred for several reasons. First, the data collected from the random 
sampling may not provide enough information to determine failure rates for each system 
component. Second, searching for generic component data, many of which are specialty 
items specific to a single aircraft type, would be very time consuming and costly. 
Finally, the fact that there are a number of Complex GA Aircraft from which, random 
sampling will probably yield a variation of aircraft types. Results of this effort are found 
throughout Section V., as well as in the various appendices. 

Reliability Block Diagrams were developed in order to determine the reliability ot 
each subsystem and system. As stated in the assumptions, each defined system and 
subsystem will be considered independent and failures of components within each 
independent. 

Finally, the data collected was analyzed to determine how well the sample 
represents the Complex GA Aircraft population. The initial desire included that the 
results of the analysis would be able to provide a result that would have at most, a 
maximum error of the estimate of one order of magnitude. The error estimate was 
determined assuming a normal distribution in order to simplify the calculations. The 
results are presented in Section V.H. 
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V. Results 


A. Aircraft 

The failure data collected from the total number of aircraft randomly sampled was 
placed in a database and separated according to the pre-defined systems and subsystems. 
The total number of aircraft sampled and included in this report was thirty-three. This 
number was comprised of aircraft data from the various types of aircraft identified in 
Table 1. Note that a few of the aircraft sampled are not complex, however in four of the 
five systems analyzed (i.e., Airframe, Electrical, Powerplant, and Flight Control Systems) 
the systems of a non-complex aircraft are very similar to that of a complex aircraft. The 
only exception occurs in analysis of the Ground Control System. In this special case, 
data from these non-complex aircraft were not used. 



Manufacturer 

Type 

9 

Mooney 

M20 (8-J and 1-K) 

5 

Piper 

PA-28R (One Turbo) 

2 

Cessna 

177RG Cardinal 

1 

Cessna 

I72RG 

1 

Beech 

A36 

3 

Cessna 

T210 Centurion 

3 

Piper 

PA-32R Saratoga (One Turbo) 

3 

Cessna 

C-152 

3 

Cessna 

C-172 

2 

Diamond 

DA20 Katana 

1 

Cessna 

1 82L 


Table 1: Aircraft Type 


B. Age 


The following histogram provides insight into the age distribution of the aircraft 
sampled (See Figure 10). The heights of the rectangles indicate frequency of occurrence 
while the solid line depicts the cumulative frequency. 


Aircraft Age 





.mm-, --mm mm 



1968 

1974 

1980 

1985 

1991 

>1991 

bmatia Frequency 1 

3 

11 

7 

8 

3 

—•“Cumulative % 

3 03% 

! 12.12% 

45.45% 

66.67% 

1 90.91% 

100.00% 


Bin 


120 . 00 % 

100 . 00 % 


80.00% 

60.00% 

40.00% 

20 . 00 % 

. 00 % 


Figure 10: Aircraft Age Distribution 
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The mean aircraft age was determined to be 18 years with a standard deviation of 
7.9 years. From the random sampling of aircraft, the tables provided above indicate that 
the sample was comprised of a relatively good mixture of aircraft manufacturer, aircraft 
type, and aircraft age. 

C. Failure Distribution Identification 

As stated previously, of these thirty-three aircraft, twenty-three were complex and 
ten were non-complex. The non-complex aircraft were used in determining the reliability 
of the systems as defined in Section V.A. This was based on the fact that there are 
minimal differences between most systems of complex and a non-complex aircraft. 

1. Descriptive Statistics 

As stated in SAE ARP 4761, Aerospace Recommended Practice, probability 
calculations for civil aircraft certifications (not GA aircraft) are based on average 
probabilities and calculated for all the aircraft of the same type 3 . The failure rates are 
assumed to be constant over time and are estimates of mature failure rates after infant 
mortality and prior to wear-out. This distribution of failures is known as the exponential 
distribution. However, if wear-out or infant mortality is a consideration, then other 
methods need to be employed in order to identify the proper distribution that describes 
the failure process for the data. As stated previously, this report covers what was termed 
Complex GA Aircraft in general, not a specific aircraft of the same type, and within the 
previously defined constraints found in Section IV. No initial assumptions regarding data 
distributions were made. 

Identification of failure distributions is basically a three-step process consisting of 
identifying candidate distributions, estimating parameters, and performing a goodness-of- 
fit test. Candidate distributions can be selected from histograms, descriptive statistics, 
analyzing the empirical failure rate, prior knowledge of the failure process, use of 
properties of the theoretical distribution, or construction of probability plots. If using 
descriptive statistics, for example, if the failure process were exponential, one would 
expect the mean and the standard deviation to be approximately equal (which is the case 
for the exponential distribution - see Appendix B) 4 . Descriptive statistics for a set of data 
can be easily obtained by using a software package. Excel has a statistical analysis 
package that allows construction of histograms as well as determination of descriptive 
statistics. 
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Tables 2 through 5 present the Complex GA Aircraft System mean and standard 
deviation parameters determined using Excel to develop the descriptive statistics. 


Airframe Subsystem 

Mean 

Standard Deviation 

Electrostatic Devices 

5193 

1959 

Empennage 

4370 

2499 

Engine Box and Cabin Fuselage 

5410 

2753 

Exterior Coatings 

2616 

1602 

Seats 

5989 

2135 

Upholstery 

3753 

1938 

Wing 

3722 

2009 


Table 2: Airframe System Descriptive Statistics 


ACS 

Mean 

Standard Deviation 

Directional 

4102 

1898 

Longitudinal 

4188 

2465 

Lateral 

5170 

2368 

Flaps 

3599 

2537 

Trim 

2900 

2683 

Hydraulic 

3660 

2645 

Landing Gear 

3927 

2547 

Steering 

3458 

2822 


Table 3: Aircraft Control System Descriptive Statistics 


Electrical Subsystem 

Mean 

Standard Deviation 

Lighting 

4918 

2526 

Source and Distribution 

4380 

2455 


Table 4: Electrical System Descriptive Statistics 


Powerplant Subsystem 

Mean 

Standard Deviation 

Engine 

4227 

2340 

Fuel 

4491 

2587 

Heating and Ventilation 

3849 

2562 

Propeller 

3445 

2372 


Table 5: Powerplant System Descriptive Statistics 


It is observed from the descriptive statistics that the subsystem distributions are 
probably not exponential (i.e., the mean does not equal the standard deviation). Only in 
the trim subsystem does the mean come close to the standard deviation. The implications 
of not being an exponential distribution indicate that the theoretical distribution may be 
time dependent. That is, the failure rate is not a constant value. Early failures or wear 
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out failures may dominate. Further analysis of the data was required in order to 
determine the proper distribution. 

2. Probability Plots 

Probability plots also provide a method of evaluating the fit of a set of data to a 
distribution. Given F(tj) is an estimate of the Cumulative Distribution Function (CDF) 
for each failure t, if one plots the points (tj, F(tj)), i = l,2,...,n, on appropriate graph paper, 
a proper fit to the distribution graphs would be a straight line. This is because the vertical 
and/or the horizontal scales have been modified to linearize the cumulative distribution 
function. Since straight lines are easily identifiable, probability plots provide a better 
visual test of a distribution than a histogram. Once again, software packages are 
available, which provide construction of probability plots in addition to ranking of 
distribution fit (i.e.. Exponential, Weibull, Normal, etc.), estimating parameters of the 
distribution being fitted, and determination of confidence bounds for these parameters. 
ReliaSoft’s Weibull++ 5.0 software package is an excellent tool that provides these 
functions and more 5 . This software provides a least-squares fit to the data, which is 
generally recommended rather than manually plotting data on probability paper and then 
fitting a straight line by eye. Over six hundred companies utilize Weibull++ software for 
analysis worldwide. 

Appendices C through F contain the probability plots that were developed for 
each of the aircraft subsystems using ReliaSoft’s Weibull-H- 5.0. This method was used 
after an initial review of the descriptive statistics for the subsystem data indicated that the 
best-fit distribution was not exponential (See Section V.C.I.). 

Of the twenty-one subsystems analyzed, the two-parameter Weibull distribution 
was found to best represent the sample data. This distribution was selected based on the 
goodness of fit, versatility, common usage in engineering, and to reduce the complexity 
of the data analysis. The two-parameter Weibull distribution is a time-dependent 
distribution that is also one of the most useful probability distributions in reliability. It 
can be used to model both increasing, constant, and decreasing failure rates. Beta ((3) is 
referred to as the shape parameter. If (3 is less than one, the failure rate is decreasing over 
time. If p is greater than one, the failure rate is increasing over time. If [3 is equal to one, 
the failure rate is constant over time. Alpha (a) is called the characteristic life. This is 
the value at which when t = a, and 63.2 percent of all Weibull failures occur, regardless 
of the shape parameter. 

A summary of the results for each of the subsystems can be found in Tables 6 
through 9. 
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Airframe Subsystem 

Distribution 

Parameters (2) 



Beta 

Alpha 





Electrostatic Devices 

Weibull 

2.53 

5.89E+03 

Empennage 

Weibull 

1.16 

5.03E+03 

Engine Box and Cabin Fuselage 

Weibull 

1.42 

6.28E+03 

Exterior Coatings 

Weibull 

1.45 

2.99E+03 

Seats 

Weibull 

2.66 

6.77E+03 

Upholstery 

Weibull 

1.79 

4.29E+03 

Wing 

Weibull 

1.79 

4.25E+03 


Table 6: Airframe System Probability Plot Distribution and Parameters 


ACS 

Distribution 

Parameters (2) 



Beta 

Alpha 

Directional 

Weibull 

1.85 

4729.02 

|ITO8iHnBnWWMi 

Weibull 

1.57 

4718.22 

Lateral 

Weibull 

2.25 

5843.58 

Flaps 

Weibull 

0.95 

3956.09 

Trim 

Weibull 

0.73 

2672.1 


Weibull 

1.14 

3977.39 


Weibull 

0.92 

2895.62 

K11S13Q9NHI 

Weibull 

1 .65 

3994.78 


Table 7: Aircraft Control System Probability Plot Distribution and Parameters 


Electrical Subsystem 

Distribution 

Parameters (2) 



Beta 

Alpha 





Lighting 

Weibull 

1.66 

5.61E+03 

Source and Distribution 

Weibull 

1.67 

4.95E+03 


Table 8: Electrical System Probability Plot Distribution and Parameters 


Powerplant Subsystem 

Distribution 

Parameters (2) 



Beta 

Alpha 





Engine 

Weibull 

1.58 

4.83E+03 

Fuel 

Weibull 

1.44 

5. 13E+03 

Heating and Ventilation 

Weibull 

1.60 

4.19E+03 

Propeller 

Weibull 

1.63 

3.74E+03 


Table 9: Powerplant System Probability Plot Distribution and Parameters 
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The summary of results found in these tables presents the two-parameters for the 
Weibull distribution. Again, the values determined for P indicate that in only a few 
cases, would the exponential distribution be considered as a candidate distribution. 


D. Goodness of Fit 

As stated previously, when using probability plotting in Weibull++, the method of 
linear least squares is used mathematically to fit a straight line to a set of points in order 
to estimate the parameters. A measure of how well a linear model fits the data is found 
by using the correlation coefficient, which is denoted by p. It is a measure of the 
correlation (linear relation) between the median ranks and the data. Median ranks are 
values used to estimate the CDF for each failure F(tj), (e.g., such as Benards 
approximation MR = (j-0.3)/(N+0.4) where j is the rank failure position and N is the total 
number of failures observed). The correlation coefficient is calculated using: 

P = Oxy I (Ox Oy) 

where: 

o x y is the covariance of x and y, G x is the standard deviation of x and, o y is the standard 
deviation of y. 

The range of p is -1 < p < +1 and the closer the value is to ±1, the better the linear 
fit (i.e., the paired values (xj,y;) lie on a straight line). A value of +1, is a perfict fit with 
positive slope while -1, is a perfect fit with negative slope. Table 10 below presents the 
goodness of fit for each subsystem using the two-parameter Weibull distribution. 


Subsystem 

Q 

Flap 

0.99 

Lateral 

0.97 

Longitudinal 

0.98 

Trim 

0.98 

Hydraulic 

0.98 

Steering 

0.94 

Landing Gear 

0.99 

Lighting 

0.98 

Source & Distribution 

0.99 

Engine 

0.99 

Fuel 

0.95 

Heating & Ventilation 

0.96 

Propeller 

0.98 

Electrostatic Devices 

0.97 

Empennage 

0.94 

Engine Box & Cabin Fuselage 

0.96 

Exterior Coatings 

0.98 

Seats 

0.98 

Upholstery 

0.96 

Wing 

0.98 


Table 10: Subsystem Correlation Coefficients 
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E. BIAS 


Unbiasedness is a desirable property in point estimation where one chooses one 
test statistic and attempts to arrive at a reasonably close estimate to a parameter they are 
trying to estimate. A statistic 0 is said to be an unbiased estimate, or the value of an 
unbiased estimator, if and only if the mean of the sampling distribution of the estimator 
equals 0. Thus a test statistic is unbiased if “on the average” its values will equal the 
parameter it is supposed to estimate. As the sample size increases, an estimate becomes 
more precise. 

As in most studies, until a sample was obtained and estimates were made, the 
parameters that describe the population were unknown. This study used a sample to 
estimate the parameters of a population. In order to provide a point estimate and a 
statement of how reasonably close the estimate was to the population parameters, the 
maximum error of the estimate is utilized. This concept is defined further in Section 
V.G. 


1 . Tests of Comparison 

Tests of comparison are performed in order to determine whether there is 
significant difference between two different sets of data. Given that the samples of data 
may be from possibly different populations, one might wish to determine any statistically 
significant difference between the populations. Many methods are available in statistical 
literature for performing this type of test. Weibull-H- allows you to compare two data 
sets using Reliasoft’s Comparison Test with the additional capability of comparing data 
sets that belong to different distributions. The methodology utilized is to estimate the 
probability, P[t 2 j ^ tij, where decisions on whether the first population is better or worse 
than the second is based on the whether the probability is smaller or greater than 0.5. 
Here t 2j represents the second data sample failure set and t,, represents the first data 
sample failure set. The estimate of P[t 2 j > tij], is made solving the following integral: 



]= jf(t)*R 2 {t)dt 


0 


A A 

Where /i(t) = pdf of the first data sample failure set (i.e., tij), and R 2 (t) = 1-cdf of the 
second data sample failure set (t 2j ). 

To solve the integral, the application uses a numerical integration technique (i.e., 
specialized Gauss-Legendre quadrature method) 4 . Quadrature Method is a numerical 
method that approximates the area of a region with a curved boundary. Gauss-Legendre 
quadrature uses a function as a parameter to calculate an integral. 

This test provides a method of answering the fundamental question, “How 
significant is the failure difference between products sampled from two different 
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locations or environments?” What the test does not tell you is why are these products 
behaving differently in two locations. This would require additional analysis to 
determine these causes. Of certain interest are any gross differences between samples. 
The results of this test really imply the following, “Do products being used at two 
different locations, or in two different environments experience the same failure causes?” 
The test does not tell you that one sample is a better sample of the population than 
another sample. A sample is a point estimate. Each sample will vary from another (i.e., 
it is unlikely that two random samples from a population will have the same identifying 
parameters). Using this defined test, significant bias (i.e., each data set probably 
represents a different population) occurs when the probability is greater than 80 percent 
or less than 20 percent. If this were to occur, further analysis would be required. 


Data is Biased if: 

Data is Not Biased if: 

Probability <20% and >80% 

Probability >20% and <80% 


Table 11: Bias Test 

In general, if P[t 2j > t u ] = 0.50 then the statement is equivalent to saying that both 
data sets are exactly equal (i.e., the data are from the same population), where t u and t 2j 
represent the test data from two sample populations. 

If P[t 2j > t„] < 0.50, or specifically, if P[t 2j > tjj] = 0.10, then the statement is 
equivalent to saying that t u is better representation of the population than t 2j with a 90% 
probability (e.g., the two samples are not from the same population or their operational 
environments have a significant effect on their failure distribution). 

Of course with any sample, there will be variation. The sampling of Complex GA 
Aircraft alone includes many types of aircraft from several aircraft manufacturers. In 
addition, it should be kept in mind, that besides these two major differences, there are 
many other factors that may also influence the aircraft failure behavior. These factors are 
presented later in this report (See Section V.E.5.). 

2. Sample Data 

For each of the aircraft systems, the data sample collected can be divided into 
three distinct areas within the United States (i.e., Other, Virginia, and Florida - from this 
point on, designated OVF) to check bias. The entire data sample collected was combined 
into a sample population that was designated OVF. In addition, the data sample can be 
divided between personal owned aircraft versus aircraft located and maintained at flight 
schools (See Section V.E.4.). Tests of comparison were performed to determine the 
significant difference between samples obtained from these defined areas and to detect 
any significant differences between personally owned versus the aircraft sample data 
obtained from flight schools. 
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3. Area Comparison Results 


Using the tests of comparison method described in Section V.E.I., the Weibull++ 
software generated the following subsystem area comparison results: 

Aircraft Control System 

1 The probability that OVF is better than Other is 53. 17% 

2 The probability that OVF is better than Virginia is 41 .24% 

3 The probability that OVF is better than Florida is 56.03% 

4 The probability that Florida is better than Other is 46.28% 

5 The probability that Virginia is better than Other is 63.49% 

6 The probability that Florida is better than Virginia is 35. 18% 

Airframe 


1 The probability that OVF is better than Other is 74.92% 

2 The probability that OVF is better than Virginia is 4 1 .07% 

3 The probability that OVF is better than Florida is 55.84% 

4 The probability that Florida is better than Other is 82.81% 

5 The probability that Virginia is better than Other is 7 1 .28% 

6 The probability that Florida is better than Virginia is 65.60% 

Electrical 


1 The probability that OVF is better than Other is 66.35% 

2 The probability that OVF is better than Virginia is 58.3 1 % 

3 The probability that OVF is better than Florida is 40. 1 2% 

4 The probability that Florida is better than Other is 75. 14% 

5 The probability that Virginia is better than Other is 57.7 1 % 

6 The probability that Florida is better than Virginia is 67.62% 

Powerplant 

1 The probability that OVF is better than Other is 66.76% 

2 The probability that OVF is better than Virginia is 55.23% 

3 The probability that OVF is better than Florida is 42.54% 

4 The probability that Florida is better than Other is 73. 1 8% 

5 The probability that Virginia is better than Other is 62.75% 

6 The probability that Florida is better than Virginia is 62.8 1 % 


These results are summarized in Table 12. For simplicity, the various levels of 
shading relate to the level of bias. The lightest region represents no bias. The next 
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region of shade represents slight bias. This process is repeated for the other shaded 
regions. 


Percent (%) 

Aircraft System 

Significance Comparison 

35.18 


FL>VA 

40.12 

Electrical 

OVF=FL 

41.07 

Airframe 

OVF-VA 

41.24 

ACS 

OVF=VA 

42.54 

Powerplant 

OVF-FL _ 

1 46.28 

ACS 

Florida=Other __ 

53.17 

ACS 

OVF=Othcr 

55.23 

Powerplant 

OVF=VA 

55.84 

Airframe 

OVF-FL 

56.03 

ACS 

OVF=FL 

[ 57.71 

Electrical 

Virginia=Other 

58.31 

Electrical 

OVF=VA 

62.75 


VA?<>flier 

v. 62 Mmmfimm 


I 

; 

_ 

■■ 

: : % 

' • 

• • •: .. 


Table 12: Sample Differences 

As depicted in Table 12, the majority of the comparisons indicate relatively little 
bias from the combined sample. That is, there are slight differences between aircraft used 
in different locations. That is, all but one of the tests of comparison indicate that the data 
is closely centered near the test value, 0.5, rather than the outer edges (i.e., <20% or 
>80%) as in accordance with Table 1 1 . Therefore, there is no evidence supporting the 
statement that the data collected from different areas is not representative of the Complex 
GA Aircraft population. 


4. Personal Aircraft versus Flight School Comparison Results 

As in Section V.E.3., comparisons between personal aircraft and flight schools 
can also be assessed for bias. Again, using the tests of comparison method described in 
Section V.E.I., the Weibull++ software generated the following subsystem comparison 
results: 

ACS 


• The probability that Personal Aircraft are better than Flight Schools is 42.90% 
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Airframe 


• The probability that Personal Aircraft are better than Flight Schools is 2 1 .69% 
Electrical 

• The probability that Personal Aircraft are better than Flight Schools is 32. 18% 
Powerplant 

• The probability that Personal Aircraft are better than Flight Schools is 3 1 .42% 


Again, there was insufficient evidence to state that the personal aircraft data and 
flight school aircraft data were significantly biased (i.e., <20% or >80%). Therefore, 
there was no evidence supporting the statement that the data collected from these two 
sources is not representative of the Complex GA Aircraft population. 

Each sample above represented a random sample of the Complex GA Aircraft 
population. As expected, each sample varies from the other. The exact cause of these 
differences is unknown, but may be determined with additional analysis. Each sample 
can be used as an estimate of the general population. However, by combining the aircraft 
samples, a larger sample size was obtained which generally provides a better estimate of 
the population parameters. 

5. Sample Variation 

Even if it were possible to ensure that every member of a population have an 
equal chance of being included in a sample, it does not follow that a series of samples 
drawn from one population and fulfilling this criterion will be identical. Each sample will 
show chance variations from one to another, and that variation may be slight or 
considerable. As stated previously, this can be caused by a number of causes. In this 
study, sources of variation in the sample may be contributed to any one or any 
combination of the following: 

• Maintenance Replacements — Based on maintenance worker training and experience 
as well as periods of maintenance. As an example, flight schools are required to 
perform 1 00-hour maintenance inspections on aircraft where private aircraft owners 
are not. 

• Environment - Corrosive (Saltwater and Acid Rain) or Temperature (High/Low) 
effects. 

• Operational Periods — High cycle rates or usage rates. 
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• Maintenance Records - Accurately report work as a failure, maintain logbooks 
correctly, or readability. 

• Pilots - Training, lifestyle, strength or personal habits. 

• Components - Variability in manufacturing or approved parts versus non-approved 

parts. 


F. Reliability Estimates 

A two-parameter Weibull distribution has a shape parameter P and a characteristic 
life parameter a. Based on the results of the probability plots for a two-parameter 
Weibull distribution and a six-hour representative cross-country flight, the reliability of 
each Complex GA Aircraft subsystem was estimated using the following reliability 
equation: 




R(t) = e 


The results of this calculation are shown in Tables 13 through 16. 


Airframe Subsystem 




Element Reliability 


Beta 

alpha 

t 

Weibull 


P 

a 

(hours) 

(time - 
hours) 







Electrostatic Devices 

2.53 

5.89E+03 

6 

0.99999997 

Empennage 

1.16 

5.03E+03 

6 

0.99959336 

Engine Box and Cabin Fuselage 

1.42 

6.28E+03 

6 

0.99994848 

Exterior Coatings 

1.45 

2.99E+03 

6 

0.99987710 

Seats 

2.66 

6.77E+03 

6 

0.99999999 

Upholstery 

1.79 

4.29E+03 

6 

0.99999223 

Wing 

1.79 

4.25E+03 

6 

0.99999208 


Table 13: Airframe System Reliability Estimates 
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ACS 


Beta 


alpha 


Element Reliability 


t 


Weibull 


Directional 

Longitudinal 

Lateral 

Flaps 

Trim 

Flydraulic 

LG 

Steering 


P 


1.85 

1.57 

2.25 

0.95 

0.73 

1.14 

092 

1.65 


a 

(hours) 

4729.02 

4718.22 

5843.58 

3956.09 

2672.1 

3977.39 

2895.62 

3994.78 


(time - 
hours) 

6 

6 

6 

6 

6 

6 

6 

6 



0.9999956 


0.9999716 

0.9999998 

0.9979040 

0.9884144 

0.9993927 

0.9966088 

0.9999780 


Table 14: Aircraft Control System Reliability Estimates 


Electrical Subsystem 




Element Reliability 


Beta 

mmm 

t 

Weibull 


P 

a 

(hours) 

(time - 
hours) 







Lighting 

1.66 

5.61E+03 

6 

0.99998831 

Source and Distribution 

1.67 

4.95E+03 

6 

0.99998650 


Table 15: Electrical System Reliability Estimates 


Powerplant Subsystem 




Element Reliability 


Beta 

msssm 

t 

Weibull 


P 

a 

(time - 

. (if 



(hours) 

hours) 

e UJ 






Engine 

1.58 

4.83E+03 

6 

0.99997436 

Fuel 

1.44 

5.13E+03 

6 

0.99994005 

Heating and Ventilation 

1.60 

4.19E+03 

6 

0.99997182 

Propeller 

1.63 

3.74E+03 

6 

0.99997219 


Table 16: Powerplant System Reliability Estimates 


At this time, it should be noted that an autopilot failure rate was estimated based 
on one failure observed on one aircraft. That means, of all the complex aircraft sampled, 
only one had an autopilot. In addition, this failure was repaired (i.e., entire unit was not 
replaced). As a conservative approach (i.e., assume one failure) an autopilot failure rate 
was calculated by dividing a single observed failure event by the total number of aircraft 
hours accumulated on that specific aircraft. This provided a conservative estimate of 
2.63 X 10' 4 failures per hour. The constant failure rate (i.e., exponential) distribution is 
used to describe failures due to completely random or chance events. The following 
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equation represents the exponential distribution (commonly used in reliability 
engineering) which was used estimate the reliability for an autopilot with a constant 
failure rate (i.e., X = 2.63 X 10' 4 failures per hour): 

R(t) = e~ h 


The autopilot reliability estimate for a six-hour mission (i.e., t = 6) is shown in 
Table 17 below. 


System 

X 

t 

Reliability 


(failures per hour) 



Autopilot 

2.63 X 10 4 

6 . 

0.9984232 


Table 17: Autopilot Reliability Estimate 


In order to assess the reliability of each Complex GA Aircraft System, series 
reliability block diagrams were used. The diagrams represent each system and present 
the concept that if a subsystem within a system fails, then the mission fails. In 
determining the system reliability, the following equation was used for series systems: 


r , -m 

i=\ 

The block diagrams and associated reliabilities for each of the Complex GA 
Aircraft Systems are presented below: 



RAirframe_System — 0.99940 



RfCS System w/ autopilot — 0.98476 
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Rocs Sysiem = 0.99598 



Lighting 

■ 

Source & 
Distribution 


R = 0.9999883 1 

1 

R = 0.99998650 


RElectricaLSystem = 0.99997 



Rpowerplanl System = 0.99986 


G. Hazard Rates 


flight: 


Using the following equation, the hazard rate can be determined for a six-hour 


Mt) = 


fa Y 


\ a A 


a 


y*-' 

) 


The results are shown in Tables 18 through 21. 


Airframe 




Hazard Rate 


Beta 

alpha 

t 

X (failures per hour) 


P 



WSSM 






Electrostatic Devices 

2.53 

5.89E+03 

6 

1 . 14E-08 

Empennage 

1.16 

5.03E+03 

6 

7.86E-05 

Engine Box and Cabin Fuselage 

1.42 

6.28E+03 

6 

1.22E-05 

Exterior Coatings 

1.45 

2.99E+03 

6 

2.97E-05 

Seats 

2.66 

6.77E+03 

6 

3.37E-09 

Upholstery 

1.79 


6 

2.32E-06 

Wing 

1.79 

4.25E+03 

6 

3.36E-06 


Table 18: Airframe System Hazard Rate Estimates 
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ACS 


Beta 


alpha 


t 


Hazard Rate 

X (failures per 
hour) 



P 



in 

Directional 

1.85 

4728.93 

6 

1.35E-06 


1.57 


6 

7.44E-06 

Lateral 

2.25 

5843.58 

6 

7.08E-08 

Flaps 

0.95 

3956.09 

6 

3.32E-04 

Trim 

0.73 

2672.1 

6 

1 .42E-03 

Hydraulic 

1.14 


6 

1.15E-04 

LG 

0.92 

2895.62 

6 

5.21E-04 

Steering 

1.65 

3994.78 

6 

5.16E-04 


Table 19: Aircraft Control System Hazard Rate Estimates 


Electrical 




Hazard Rate 


Beta 

Alpha 

t 

X (failures per 
hour) 


P 

a 

(hours) 

(time - 
hours) 

p Y / A' 

U A«J 






Lighting 

1.66 

5.61E+03 

6 

3.24E-06 

Source and Distribution 

1.67 

4.95E+03 

6 



Table 20: Electrical System Hazard Rate Estimates 


Powerplant 




Hazard Rate 


Beta 

alpha 

t 

X (failures per 
hour) 


P 



mm 






Engine 

1.58 

4.83E+03 

6 

6.75E-06 

Fuel 

1.44 

5.13E+03 

6 

1 .44E-05 

Heating and Ventilation 

1.60 

4.I9E+03 

6 

7.51E-06 

Propeller 

1.63 

3.74E+03 

6 

7.56E-06 


Table 21: Powerplant System Hazard Rate Estimates 


In order to determine the system hazard rate for failures governed by the Weibull 
failure law, then the following equation is utilized (See Appendix G) : 
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Using the hazard rates presented in Tables 18 through 21, it can be seen that the 
system hazard rates for a 6-hour flight are: 

7 

^Airframe System(t=6) = X ^,(6) = 1.25 x 10 4 failures per hour 
i=l 


6 

^fcs System(t=6) = X A^(6) = 2.02 x 10' 3 failures per hour 
i=l 


3 

A-gcs Sysiem(t=6) = X Ah(6) = 6.37 x 10' 4 failures per hour 
i=l 


2 

^-Electrical Systein(t = 6) — X X.j(6) = 7.00 x 10 failures per hour 
i=l 


4 

^■Powerpiant System! t = 6) = X A^(6) — 3.62 x 10 failures per hour 
i=l 


H. Confidence 


In order to address the issue as to whether or not the results of our sample provide 
an estimate of the population mean that is off by at most one order of magnitude, the two 
following methods were used. 

1. Large Sample Size 


For large sample sizes (i.e., n > 30) the normal distribution was used to determine 
the confidence of the mean value obtained from the sample distribution. With the desired 
degree of precision (i.e., maximum error of estimate “E” of one order of magnitude), 
sample size, and sample standard deviation “s”, the confidence that “s” is a good estimate 
of the population standard deviation “o” can be determined using the following 
equation: 


E = 


■a! 2 


S 


Vn 
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2. Small Sample Size 


For the small sample sizes (i.e., n < 30) the student t distribution was used to 
determine the confidence of the mean value obtained from the sample distribution. The 
equation is similar to that seen above: 


E tall * /— 

yjn 


The difference here is that with a large sample size it is reasonable to substitute in 
the sample standard deviation s. With a small sample size, one must make the 
assumption that the sample comes from a normal population. The student t distribution 
has a parameter v (i.e., degrees of freedom) that is equal to n-1. 


By using the equations defined above and the mean and standard deviation 
estimated using descriptive statistics, confidence limits can be determined for each of the 
Airframe Subsystems. Typical confidence estimates are made using 0.95 and 0.99. For 
this study, a confidence of 0.95 is selected with corresponding z «/2 = 1 -96. Similar 
values for t an are 1.701 (n=29) and 1.796 (n=12). It is noted here that E, stands for the 
maximum value of | x — (X | (i.e. the maximum error of the estimate). This can now be 
added to modify the sample size equations to determine confidence bounds. 


p-x± 


(Zq/2**) 

4~n 


The results of the calculations are found in Tables 22 through 25. 



s 

n 

E 

"Zot/2 


Zo/2 


Standard 

Deviation 

Number of 
Failures 

s 

Zal2 

Vrt 

Lower 

Bound 

Population 

Mean 

(failure time 
- hours) 

Upper 

Bound 








Electrostatic Devices 

1959 

23 

847 

4346 

5193 

6040 

Empennage 

2499 

25 

1032 

3338 

4370 

5402 

Engine Box and Cabin 
Fuselage 

2753 

123 

487 

4924 

5410 

5897 

Exterior Coatings 

1602 

14 

925 

1691 

2616 

3541 

Seats 

2135 

105 

408 

5580 

5989 

6397 

Upholstery 

1938 

8 

1620 

2133 

3753 

5373 

i * 

Wing 

2009 

16 

1070 

2652 

3722 

4793 


Note: Student t distribution used in calculations (i.e. small sample size, use t o/2 in place of Z a/2 ) 


Table 22: Airframe System Error Estimates (Confidence = 95%) 
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s 

n 

E 

”Z a/2 


Z a/2 


Standard 

Deviation 

Number of 
Failures 

S 

7 f , • 

^a/2 f— 

v// 

Lower 

Bound 

Population 
Mean 
(failure 
time - 
hours) 

Upper 

Bound 

Directional* 

1898 

29 

722 

3380 

4102 

4824 

Longitudinal 

2465 

31 

868 

3320 

4188 

5056 

Lateral 

2368 

35 

785 

4386 

5170 

5955 

Flap 

2537 

45 

741 


3599 

4340 

Trim 

2683 

49 

751 

2149 

2900 

365 1 

Hydraulic 

2645 

81 

576 

3084 

3660 

4236 

LG 

2547 

318 

280 

3647 

3927 

4207 

Steering* 

2822 

12 

1793 j 

1665 

3458 

525 1 


Note: Student t distribution used in calculations (i.e. small sample size, use t 0/2 in place of z a!2 ) 


Table 23: Aircraft Control System Error Estimates (Confidence = 95%) 



s 

n 

E 

-Zq/2 

4 

■JIM 


Standard 

Deviation 

Number of 
Failures 

s 

^a/2 * r~ 

V/i 

Lower 

Bound 

Population 

Mean 

(failure time 
- hours) 

Upper 

Bound 








Lighting 

2526 

82 

547 

4731 

4918 

5465 

Source and Distribution 

2455 

262 

297 

4083 

4380 

4677 


Note: Student t distribution used in calculations (i.e. small sample size, use t a/2 in place of z ot/2 ) 


Table 24: Electrical System Error Estimates (Confidence = 95%) 



s 

n 

E 

"Zo/2 

4 

Zoe/2 


Standard 

Deviation 

Number of 
Failures 

s 

7 • 

^a/2 r~ 

■yjn 

Lower 

Bound 

Population 

Mean 

(failure time 
• hours) 

Upper 

Bound 








Engine 

2340 

864 

156 

4071 

4227 

4383 

Fuel 

2587 

143 

424 

4066 

4491 

4915 

Heating and Ventilation 

2562 

32 

888 

2961 

3849 

mssm 

Propeller 

2372 

99 

467 

2978 

3445 

■eedm 


Note: Student t distribution used in calculations (i.e. small sample size, use t a/2 in place of Z tx/2 ) 


Table 25: Powerplant System Error Estimates (Confidence = 95%) 


Accordingly, one can now say with 95% confidence that the error of the estimate 
of the mean values found in Tables 22 through 25, is at most “E,” which is also found in 
the respective tables. 
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In order to place confidence intervals on the hazard rates, this study utilizes the 
Weibull parameters that were calculated with the Weibull-H- software (see Appendix H). 
Confidence intervals for Weibull distribution parameters P and a are mathematically or 
computationally difficult to obtain 4 . Numerical techniques or specialized tables are 
usually required to calculate these values. The Weibull-H- software provides a method 
for estimating these bounds with a desired confidence. Lower and upper bounds for each 
of the parameters were estimated using the properties of Maximum Likelihood 
Estimators. The following equations are used to estimate the upper and lower bounds 6 : 


Upper Bound 


f Ka-JVar(fi) } 



Lower Bound = 
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/ 

War 


' 

) 

V 

$ 



Upper Bound 


a v - a- e 


K a yjVar(d) \ 


a 


Lower Bound oc L 


a 


' KjVarj&y 

a 

J 


Where K a is defined by: 


a = - 1 == \e ~^/ = l-0(tf a )r 


If 5 is the confidence level, then a = ( 1 -8)/2 for the two-sided bounds, and 
a =1-8 for the one-sided bounds. 

The variances and the covariances are estimated using the Fisher Matrix 7 . 

Utilizing the previous methods for estimating system hazard rates for a six-hour 
flight (See Section V.G.) the upper and lower bound system hazard rates were calculated. 
These estimates are presented in Table 26. 
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System 


System X 

Upper System X 





Electrical 

3.30E-05 

6.82E-06 

I.26E-06 

Airframe 

1 .96E-03 

1.23E-04 

4.28E-06 


1 .93E-04 

3.63E-05 

8.28E-06 

msmebbbsm 

5.09E-03 

2.0 IE-03 

4.13E-04 

Ground Control 

1 .5 1 E-03 

6.37E-04 

3. 10E-04 


Table 26: System Hazard Rate Estimates (Confidence = 95%) 


In addition, lower and upper reliability bounds can be estimated by utilizing the 
data provided in Appendix H and the method described previously in this study (See 
Section V.F.) to calculate system reliability. These results are shown in Table 27. 


System 

Lower System 
Reliability Bound 

System 

Reliability 

Upper System 
Reliability Bound 





Electrical 

0.999861 

0.999974 

0.999996 

Airtrame 

0.98721 

0.99940 

0.99998 


0.99909 

0.99986 

0.99997 


0.95055 

0.98476 

0.99584 

Ground Control 

0.98995 

0.99598 

0.99820 


Table 27: System Reliability bounds (Confidence = 95%) 



































VI. Conclusion 


As stated initially, the current reliability of Complex GA Aircraft Systems was 
unknown. The ability to gain insight into this unknown will provide the aviation 
community with a valuable benchmark that will assist in the development of reliability 
and safety requirements for future aircraft. The approach used in this study to estimate 
the current reliability of Complex GA Aircraft Systems (i.e., Airframe, Electrical, 
Powerplant, Flight Control, and Ground Control) utilized a random sample that reflects 
the actual aircraft-operating environment. The operational failures observed, occurred 
under actual operational conditions of use and environment and therefore provided 
valuable information, supportive to our study. The aircraft logbooks provided 
information on component failures as well as preventive maintenance activities (i.e., 100 
hour and annual inspections). The random sampling method described within this study 
provided a means of estimating the reliability of Complex GA Aircraft Systems. The 
approach used to estimate the Cockpit Instrument reliability is described in Appendix A. 

System reliability estimates are based on the probability that a Complex GA 
Aircraft Airframe System will successfully complete a 700 nautical mile six-hour flight. 
The system reliability estimates are determined to be: 


System 

Reliability Estimate 



Airframe 

0.99940 

Electrical 

0.99997 

Powerplant 

0.99986 

Flight Control 

0.98476 

Ground Control 

0.99598 

Cockpit Instrumentation 

0.976 


Table 28: System Reliability Estimates (all calculations based on a six-hour flight) 


It should be noted once again, that this study did not include aircraft that have 
been involved in catastrophic events caused by component failures. The ability to obtain 
aircraft records on such aircraft would probably require FAA involvement and also 
present legal issues that could not be addressed within the timeframe of this task. 

The exponential distribution is not the only method that may be used to determine 
system failure rates. It is commonly used in reliability and provides an excellent method 
for estimating system reliability. The exponential method was used in the analysis of the 
Cockpit Instrumentation System (See Appendix A). As stated previously, probability 
calculations for civil aircraft certifications (not GA aircraft) are based on average 
probabilities that are calculated for all aircraft of the same type probabilities (i.e., failure 
rates are assumed to be constant). However, if wear-out or infant mortality is a 
consideration then other methods must be used in the determination of distribution which 
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best fits the data. As observed in Section V.C.I., other methods were necessary and 
therefore employed in this reliability study to aid in the determination of the proper 
failure distribution that best represents the data. The data from aircraft logbooks was 
treated as failure data for this reliability study according to the groundrules and 
assumptions previously presented in Section IV. This usage was based on the fact that 
items were being replaced rather than undergoing preventive maintenance actions (e.g., 
servicing). That is, these components were determined to be no longer able to perform 
their designed function and were therefore replaced with a new component. Preventive 
maintenance actions are not performed on items that are described by an exponential 
distribution (i.e., constant failure rate with random failures). By identifying the proper 
failure distribution that describes the failure process, it was determined that an 
exponential distribution does not accurately represent the data and that the method of 
identifying theoretical distributions as described in the analysis of aircraft logbook data 
was therefore necessary and appropriate. The distribution that best described these 
failure processes was the two-parameter Weibull distribution. The Weibull distribution is 
widely used in engineering and can be used to model both increasing and decreasing 
failure rates. 

The data obtained provided a random sample of Complex GA Aircraft that was 
sufficiently large enough to estimate the reliability of the Complex GA Aircraft Systems 
and provide an associated confidence that the represents the complex aircraft population, 
with an error of estimate that was within an order of magnitude. In addition, tests were 
performed to measure how well the data fit the identified distribution and to determine 
whether there was significant bias between data sources (See Sections V.D. and V.E.). 
From the goodness of fit test, the analysis results indicate that the Weibull distribution 
provided a very good fit of the sample data. In addition to this fit, there is a positive 
correlation with the sample data. In the determination of data bias within the sample, the 
analysis results indicate that the aircraft sample used does accurately represent data from 
a single population. There is no significant bias between the samples from different 
locations or from different sources (i.e., flight school aircraft vs. personal aircraft). 
Again, this indicates that the sample aircraft does represent data from a single population. 


The reliability estimates presented in this report will provide the aviation 
community with a benchmark of the current Complex GA Aircraft System reliability, 
upon which future requirements and specifications can be based. 
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Executive Summary 


The Advanced General Aviation Transport Experiment (AGATE) Program is 
composed of a government-industry-university consortium with a goal to develop 
the technologies for the revitalization of the US general aviation industry. This 
program is designed to make the general aviation aircraft in in the US accessible 
to the majority of the population. This obviously requires an aircraft that is simple 
to operate, safe, and reliable. 

To achieve the Reliability aspect of the program’s goal, the baseline reliability of 
the instruments found in the current general aviation cockpit is needed. Those 
instruments provide information with which the pilot operates the aircraft. The 
cockpit information addressed in this report was grouped into the following six 
categories: 

• Airspeed information. 

• Altitude information. 

• Attitude information. 

• Advisory Panel (aircraft status) information. 

• Communication information. 

• Navigation information. 

The data presented in this report reflects the probability that the information in 
the six categories listed above will be provided during a typical 700 nautical mile 
six-hour flight. This report also contains a summary of piloting functions, a brief 
description of the current cockpit information, and a fault tree designed to predict 
the reliability of current, typical general aviation aircraft instruments. A number of 
sources were used in assembling the reliability data of the current instruments. 
Due to proprietary concerns, those sources are not identified. 

The major assumptions for this analysis are: 

• Human factors were not considered. 

• The aircraft used was representative of general aviation aircraft population. 

• External cues and information (looking out window) were not considered. 

• Criticality of information was not considered. 

• All ground-based navigation aids are available. 

• All components will exhibit an exponential time to failure distribution. 

• Environmental elements were not considered. 

• Partial failures were not considered. 

• Out-of-tolerance conditions were considered failures. 

With the above assumptions and available reliability information, a current 
general aviation aircraft would have a 0.976 probability of completing the given 
flight profile without loss of any of the required cockpit instrumentation 
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information. This is the baseline against which the AGATE cockpit should be 
compared. 
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ADF 
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Introduction 


The Advanced General Aviation Transport Experiment (AGATE) is a program 
being pursued by a government-industry-university consortium. The experiment 
has as its goal to develop new technologies that will revitalize the US general 
aviation industry. Future aircraft and supporting technology developed through 
the AGATE initiative will emphasize safety, affordability, and ease of use for a 
single pilot. The envisioned future aircraft system will consist of a single-engine, 
near-all-weather transportation aircraft and related training, airspace, and ground 
infrastructure systems. 

This report includes considerable information from the field of aviation and the 
basics of flying. Readers of this report who are familiar with general aviation 
aircraft equipment and terminology should first review Basic Aircraft 
instruments, beginning on page A-34. 

The AGATE program is designed to make the general aviation aircraft in the US 
accessible to the majority of the population, as well as make personal air 
transportation comparable to using private automobiles for trips between 150 
nautical miles (NM) and 700 NM. Such a goal requires an aircraft that is simple 
to operate, safe, and reliable. 

In order to establish the reliability goal of a future aircraft cockpit, a baseline of 
the reliability of the current general aviation cockpit must first be developed. This 
report is an evaluation of the reliability of the current cockpit for a single-engine, 
Instrument Flight Rule (IFR) 1 qualified aircraft capable of transporting four people 
(operator and three passengers) up to 700 NM. 

The purpose of this analysis is to provide the predicted reliability of the cockpit 
instrumentation of a typical general aviation aircraft. This prediction is based on 
the available empirical data obtained for this report. This data was difficult to 
obtain for a number of reasons - not the least of which was proprietary concerns. 
The major reason for the difficulty was, however, the fact that there is no central 
clearinghouse for the retention of such data. General aviation aircraft 
instruments are maintained and repaired by myriad maintenance and service 
facilities throughout the world. 


Within the US there are several layers of airspace under control of the Federal Aviation Administration (FAA) Air Traffic 
Control (ATC) centers. Flight into this airspace specifically requires aircraft to be operating under IFR. IFR allows for safe 
operation of aircraft in weather conditions that normally prevent or reduce a pilot’s ability to maintain visible reference to 
(1) the ground for navigation and (2) the horizon for attitude control. 
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An aircraft cockpit’s instrumentation is designed to provide the pilot operator with 
various elements of information required to safely fly the aircraft. Some of that 
information is critical to continued safe flight; while other information is often not 
as critical under normal flying conditions. The criticality index of the information 
is highly dependent on pilot experience and training, weather conditions, and 
location. Since the human element was not a factor in this analysis, no 
judgement was made regarding the criticality index of one element over another. 

Federal Aviation Regulations (FAR) Part-91 specifies the minimum 
instrumentation required for general aviation aircraft flying under IFR conditions. 
The minimum instruments are: 

• Airspeed indicator. 

• Altimeter. 

• Magnetic Direction Indicator. 

• Tachometer for each engine. 

• Oil pressure gauge for each engine. 

• Temperature gauge for each air-cooled engine. 

• Oil temperature gauge for each air-cooled engine. 

• Manifold pressure gauge for each engine if a variable pitch propeller is used. 

• Fuel gauge indicating the quality of fuel in each tank. 

• Two-way radio communications system and navigational equipment 
appropriate to the ground facilities to be used. 

• Gyroscopic rate-of-turn indicator. 

• Slip-skid indicator. 

• Altimeter adjustable for barometric pressure. 

• Clock displaying hours, minutes, and seconds. 

• Generator or alternator. 

• Gyroscopic pitch and bank indicator (artificial horizon). 

• Gyroscopic direction indicator (directional gyro or equivalent). 

This report presents the predicted reliability of the basic, FAA-required cockpit 
instruments. These instruments are considered typical of all IFR-capable, 
general aviation aircraft. There are a number of other instruments available to be 
mounted in general aviation aircraft, which are not required by the FAA (Loran, 
GPS, radar altimeter, etc.). This analysis does not consider these additional 
instruments. 

Instrumentation is provided to the pilot via the instruments listed above. For this 
analysis, the cockpit reliability was the probability that these instruments would 
accurately provide the information for which they were designed. It was 
assumed that an instrument failed when it did not function normally or provide 
accurate information. It was assumed that the cockpit failed if the required 
information could not be determined by any one instrument or combination of 
instruments. The importance of the lost information on the total aircraft operation 
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was not considered in this analysis. The analysis was concerned with the loss of 
that information and its impact on cockpit reliability. Additionally, this report 
disregards any information that a pilot may obtain from looking outside of the 
aircraft. 

The information provided by the instruments was analyzed and categorized into 
the following six general groups: 

• Airspeed information. 

• Altitude information. 

• Attitude information. 

• Advisory Panel 2 (aircraft status) information. 

• Communication information. 

• Navigation information. 

In order to understand how the various instruments work together to provide a 
synergistic knowledge environment for the pilot, one must understand the basics 
of piloting. The following is a brief description of the information supplied by 
those groups of instruments. This awareness is important in order to 
understanding the fault tree logic presented later in this report. 

Airspeed information may be obtained by any one of three means - airspeed 
indicator, engine power setting, or contact with the ATC. The airspeed indication 
system, the primary reference for airspeed information, calculates the airspeed 
by measuring the difference between the total air pressure 3 and the atmospheric 
air pressure. The Pitot system supplies the dynamic pressure to the indicator. 
There is a possibility that ice may block the Pitot tube and cause the instrument 
to give erroneous data; so, there is a heating element in the tube that operates 
from electrical power supplied from the alternator. (This is a situation where 
weather conditions would be important if criticality was a consideration for the 
different events). Another way to determine airspeed is with the tachometer, 
which quantifies the engine power output. If the engine power is known, a pilot 
can deduce his airspeed. Pilots often set their cruising airspeed by engine 
power. A pilot may also determine airspeed by contacting and ATC center. The 
ATC can calculate and provide the pilot the aircraft’s ground speed. The 
transponder enables the ATC to match its radar track with that particular aircraft. 
The radio is used to convey the information to the pilot. 

Altitude information is normally supplied by the altimeter. The altimeter 
measures the difference in air pressure between the aircraft’s current altitude and 
a reference altitude (usually sea level). It then calculates the difference in feet. If 
the altimeter should fail in flight, altitude information can be less-accurately 
calculated to complete that flight by using the vertical speed indicator and the 
clock on the Advisory Panel. 


2 

Advisory Panel is also known as the Annunciator Panel and the Warning/Caution Panel. 

nfotal air pressure consisting of the atmospheric pressure and the dynamic pressure caused by traveling through the air. 
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Assuming that the pilot knew the assigned (or observed) altitude before the 
altimeter failed, a simple calculation of vertical airspeed (feet per minute) over 
time (minutes) will provide that approximate altitude information. (While a watch 
may appear to be completely satisfactory replacement for the cockpit clock, it is 
not considered a cockpit instrument. The FAA does not make allowances for a 
watch to substitute for the clock). 

Attitude information consists of three elements — roll, yaw, and pitch. This is 
important information for the pilot because he may inadvertently progress into an 
undesirable attitude when deprived of visual references with the ground. This is 
a common problem when flying at night or in conditions of limited visibility. The 
attitude indication system (the gyroscopic pitch, bank, and direction indicators) 
and Turn Coordinator are the primary instruments that provide this attitude 
information. They allow the pilot to determine if the wings are straight and level. 
The attitude indication system requires pneumatic power and the Turn 
Coordinator requires electrical power. Pitch information may be obtained by 
either direct observation of the attitude indicator or it may be deduced by 
observing changes in either altitude or airspeed. If an aircraft’s speed is 
increasing, the engine power has not changed, a pilot knows that the aircraft is in 
a dive (pitch down). The Turn Coordinator, as its name implies, is used to make 
balanced turns. This is important in reducing “skid,” indicating “side slip,” and in 
improving the turn efficiency. Changes in an aircraft’s yaw may be determined 
by the Balance Ball 4 in the Turn Coordinator or the Directional Gyro. 

The Advisory Panel supplies information on aircraft status. The status 
information elements required by the FAA are fuel quantity, oil 
pressure/temperature, pneumatic (vacuum pressure, and ammeter 5 . Some 

cockpit layouts may not have all of these instruments located on the same panel. 
For this report, the Advisory Panel refers to the instruments, which provide the 
status information, not the panel, itself. 

Radio communications are required for entering certain airspace. They are 
also required by the FAA for IFR flight. The transponder is part of the 
communications group. It identifies the aircraft to ATC. 

Navigation is composed of three elements — vector navigation (sometimes 
refereed to as dead-reckoning), radio navigation, and pilotage. Vector navigation 
is used to transverse from one point to another. It uses basic mathematics, i.e., 
movement at a known speed, along a known bearing, for a known amount of 
time. Radio navigation is used for determining current position in relation to FAA 
navigational aids. The Auto Direction Finder (ADF) and VHF Omni Range (VOR) 
are used for radio navigation. These instruments use a ground-based transmitter 
at a known position in order to determine bearing. 


4 The Turn Coordinator is composed of the Balance Ball and T urn Needle. For this analysis they are treated as one unit. 
5 The FAA requires a generator, not an ammeter, however its use is so universal, it is considered as a requirement for the 
aircraft instrumentation. 
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Airspeed and Attitude information are needed to maintain an aircraft’s lift and 
control. Altitude information is very important to safe flying, especially in 
conditions of limited visibility. The Advisory Panel information alerts the pilot to 
the condition of the aircraft with information on engine status and fuel available. 
Communications information helps alert the pilot to flying conditions and other air 
traffic. Navigation information gets the aircraft to its destination and helps to 
avoid obstacles en route. The information for each of these groups is obtained 
from individual instruments or by combining information from several instruments; 
and there is considerable interdependence among the groups. 

This analysis also includes some components and subsystems that are not 
physically in the cockpit; but they are important in that they supply data or power. 
Among these supporting subsystems are the Pitot tube system and electrical 
power supply. Current general aviation aircraft have two types of power to 
operate the instruments - electrical and pneumatic. Typical general aviation 
aircraft power all of their instruments by electrical power, except for the 
directional gyro and attitude indicator, which are powered by vacuum pumps. 

Only one source of electrical power was considered - the alternator. If the 
alternator failed during flight, the aircraft would terminate its flight as soon as 
possible, even though all of the instruments may be able to function for a limited 
amount of time from power supplied by the battery. Electrical power is required 
by most instruments in the cockpit. 

There are currently scores of different types of general aviation aircraft in service. 
Additionally, there are numerous configurations of cockpit instruments with which 
individual owners may customize their aircraft. The only commonality is the 
FAA’s requirement for specific instruments. This situation results in numerous 
instrument configurations. As such, a reliability analysis of specific configurations 
is impossible. The instruments used in this analysis are typical, however, of most 
general aviation aircraft. 

Data for this analysis was surprisingly sparse. Information on aircraft cockpit 
components was gathered from general aviation aircraft manufacturers and from 
general aviation maintenance personnel. The manufacturers tended to husband 
their data to its proprietary nature. Additionally, the aviation repair community 
(composed of thousands of small organizations) lacks the resources to collect 
Mean Time Between Failure (MTBF) data. (There is no FAA requirement for 
then to maintain such data). Data was also obtained from a commercial delivery 
company that operates single-engine, cargo aircraft. In addition to being similar 
to the aircraft under study, their aircraft had instruments and design 
characteristics common to all small aircraft. 

This analysis did not consider mission phases. A simple mission profile of start- 
up to shut-down was used. Normal operating procedures call for power to all 
instruments throughout the flight, even though they may be used only during 
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short phases of the flight, such as landings. The mission used in this analysis 
was a 700- NM trip 6 . With a mean velocity of 120 knots 7 , the flight would last 
approximately 5.83 hours. Taking into consideration pre-and post-flight taxing, a 
mission time of six-hours was used. This profile is representative of a typical 
cross country flight. 

As single model of general aviation aircraft was used for a standard 
configuration. Where multiple sources of aircraft instrument reliability data was 
available; a non-weighted 8 average was used to obtain a single MTBF number. 

A number of assumptions were made in order to confine this analysis to a 
manageable level. Some of them were: 

• Human factors were not considered. 

• The aircraft used was representative of general aviation aircraft population. 

• External cues and information (looking out window) were not considered. 

• Criticality of information was not considered. 

• All ground-based navigation aids are available. 

• All components will exhibit an exponential time to failure distribution. 

• Environmental elements were not considered. 

• Partial failures were not considered. 

• Out-of-tolerance conditions were considered failures. 

The assumption concerning exponential time-to-failure distribution is critical. 
Although this distribution is commonly used for electronic components, its 
application for mechanical systems could result in questionable findings. With 
more detailed failure data for mechanical systems, a simulation would provide 
improved accuracy of predicted reliability. 

This analysis utilized the fault tree methodology to predict the reliability of the 
current general aviation cockpit’s instrumentation. Fault tree analyses have 
gained wide acceptance and appreciation as one of the more powerful analytic 
tools for the study of complex systems. They enable deductive analysis to 
determine possible causes of an event or action; and, they provide qualitative as 
well as quantitative, results. A fault tree is a graphic model of the pathways 
within a system that can lead to a foreseeable, undesirable event. The events 
are not component parts of the system being analyzed; rather, they are symbols 
representing the logic of analysis. 


^his is the maximum range AGATE requirement being considered. 

7 This is a typical cruising speed. 

8 Each MTBF number was considered as equally representative of the component’s reliability. 
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There are three types of events used in the analysis of a cockpit instrumentation 
reliability fault tree: 


Basic Event The initiating fault not developed further. In 

this analysis a basic event is the failure of a 
hardware item. 


Intermediate Event The system state produced by the preceding 

events. 


Top Event The foreseeable undesirable event to which all 

fault tree logic flows. 


Figure A1 , Cockpit Instrumentation Reliability Fault Tree (located at the end 

of this section) shows the fault tree used to determine the cockpit reliability. The 
elements in the tree are read left to right. Its Top Event is “Loss of Cockpit 
Instrumentation Information.” This fault tree was developed using one particular 
model of general aviation aircraft as a model for the basic equipment, design, 
and cockpit layout. To distinguish it from a second fault tree to be discussed 
later, this fault tree will be referred to as the “primary” fault tree. 

At the second level of the fault tree, there are six intermediate events feeding into 
the top event. The loss of any of those intermediate events will cause the loss of 
the cockpit instrumentation information. The events on the second level are: 

1 . Loss of Airspeed Information. 

2. Loss of Attitude Information. 

3. Loss of Advisory Panel Information. 

4. Loss of Altitude Information. 

5. Loss of Navigation Information. 

6. Loss of Communication Information. 

Loss of Airspeed Information requires all of the three intermediate and basic 
events to occur. 

Loss of Airspeed Indicator System: This event requires any or all of the 
intermediate or basic events to occur. This include failure of the: 

Air Speed Indicator fails, and/or 
Loss of Pitot Static System. 


Tachometer Fails This is a basic event. 


A - 13 



Loss of Communications Information: This event requires any or all of 
the intermediate events to occur. This include failure of the: 
Transponder System, and/or 
Loss of Voice Communications. 

Loss of Attitude Information requires any or all of the three intermediate events 
to occur. 

Loss of Roll Information: This event requires both of the intermediate 
events to occur. This includes: 

Loss of Attitude Indication System, and 
Loss of Turn Coordination Indication. 

Loss of Pitch Information: This event requires all three of the 
intermediate events to occur. This includes: 

Loss of Airspeed Information, 

Loss of Attitude Indication System, and 
Loss of Altitude Information. 

Loss of Yaw Information: This event requires both of the intermediate 
events to occur. This includes: 

Loss of Directional Gyro System, and 
Loss of Turn Coordination System. 

Loss of Advisory Panel Information requires any or all of the intermediate or 
basic events to occur. 

Ammeter/Vacuum Pressure Gauge Fails: This is a basic event. 

Oil Temperature/Pressure Gauge Fails: This is a basic event. 

Loss of Clock System: This event requires any or all of the basic events 
to occur. This includes: 

Clock Fails, and/or 
Alternator Fails. 

Loss of Fuel Quantity Indication: This event requires any or aH of the 
basic events to occur. This includes: 

Right Fuel Quantity Transducer Fails, 

Left Fuel Quantity T ransducer Fails 
Fuel Quantity Indicator Fails, and/or 
Alternator Fails. 


Loss of Altitude Information requires any or all of the intermediate or basic 
events to occur. This includes: 
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Altimeter Fails: This is a basic event. 

Loss of Vertical Speed Information: This event requires any or aj] of the 
basic events to occur. This includes: 

Vertical Speed Indicator Fails: This is a basic event. 

Loss of Clock System: (See previous description). 

Loss of Navigation Information requires any or all of the intermediate events to 
occur. This includes: 

Loss of Vector Navigation Information: This event requires any or all of 

the intermediate or basic events to occur. This includes: 

Loss of Airspeed information: (See previous description). 

Loss of Clock System: (See previous description). 

Loss of Heading Information: This occurs if aN of the following 
intermediate and basic events to occur: 

Loss of Turn Coordination Indication, 

Magnetic Compass Fails (Basic Event), and 
Loss of Directional Gyro System. 

Loss of Radio Navigation: This requires all of the intermediate events to 
occur. These intermediate events are: 

Loss of VOR: This occurs if any or ajl of the following basic events 
occur: 

VOR Antenna Fails, 

VOR Receiver Fails, 

VOR Display Fails, and/or 
Alternator Fails. 

Loss of ADF: This occurs if any or aH of the following basic events 
occur: 

ADF Antenna Fails, 

ADF Receiver Fails, 

ADF Display Fails, and/or 
Alternator Fails. 

Loss of Instrument Landing System (ILS): This occurs if any or all of the 
intermediate events occur. These intermediate events are: 
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Loss of Localizer/Glideslope Signal: This occurs if any or ajj of the 
following basic events occur. These intermediate events are: 

ILS Receiver Fails, 

ILS Localizer Antenna Fails, 

ILS Glideslope Antenna Fails, and/or 
Alternator Fails 

Loss of ILS Display: This occurs if any or al] of the following basic events 
occur: 

ILS Display Fails, and/or 
Alternator Fails. 

Loss of Marker Beacon Signal: This occurs if any or all of the following 
basic events occur: 

Marker Beacon Receiver Fails, 

Marker Beacon Antenna Fails, and/or 
Alternator Fails 

Loss of Communications Information occurs if any or aH of the following 
intermediate events occur. 

Loss of Voice Communications: This occurs if any or a|l of the following 
basic events occur: 

Communications Radio Fails, 

Communications Antenna Fails, and/or 
Alternator Fails 

Loss of Tracking Signal: This occurs if any or ah of the following basic 
events occur: 

Transponder Fails, 

Transponder Antenna Fails, and/or 
Alternator Fails 

From the primary fault tree, it can be seen that several basic and intermediate 
events occur multiple times. The alternator, which is the sole source of electrical 
power, is the most prominent. It is emphasized that there is only one alternator 
on the type of aircraft in this study. 

In that fault tree, the loss of a particular component did not necessarily mean a 
loss of information; because, a pilot could cross check 9 his instrument panel and 
obtain the information with other instruments. 


9 Scanning of instrument panel to double-check instrument readings. 
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An alternative fault tree was developed in an excursion to establish the reliability 
of the cockpit instruments as a function of simple, straightforward hardware 
failures - independent of the information those same instruments would provide, 
as was done in the primary fault tree. In this alternative fault tree, every 
hardware item was a basic event to the top event, “Loss of Cockpit 
Instrumentation.” Every hardware item fed to the Top Event as an “or” gate. 
There were no intermediate events. Due to its simple nature and unremarkable 
revelations, the alternative fault tree is not included in the report. 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree 














A - 19 


Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 










Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 
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Figure A1. Cockpit Instrumentation Reliability Fault Tree (Continued) 





Analysis Results 

This analysis shows that the current general aviation cockpit has little 
redundancy in its design. Presently, flight safety and success relies heavily on 
pilot training and situational awareness. Today’s pilots receive extensive training 
in cross-checking and emergency procedures. One of the goals for the aircraft 
envisioned in the AGATE Program is to relieve the necessity of this 
comprehensive training by incorporating the cross-checking processes into the 
instruments, thereby greatly simplifying the piloting procedures. 

This analysis predicts that a current general aviation aircraft, on a 700 NM trip 
taking approximately six-hours, would have a 0.976 probability of completing that 
trip without losing any cockpit instrumentation information. The fault tree model 
calculated an unreliability of 0.024. Unreliability is the probability that the system 
will experience a failure that will result in the loss of information during its six- 
hour flight. This indicates that there is a 0.024 probability that the pilot will lose 
some cockpit instrumentation information during a six-hour flight. 

This compares with a prediction of 0.041 probability that at least one instrument 
will fail, as calculated by the pure hardware-failure fault tree (not included). That 
was the situation where every component was a basic event to the “Loss of 
Cockpit Instrumentation Information” event. This appears to be a significant 
difference in unreliability. More detailed reliability data is required in order to 
evaluate whether this is a statistically significant difference. The use of cross- 
checking for information from multiple instruments appears to improve cockpit 
information reliability. This is what would be expected. The 0.041 unreliability 
may be put into these terms - there is a 0.041 probability that at least one of the 
instruments required will fail. There is a 0.959 probability that a six-hour mission 
will be completed without a component failing. 


The unreliability predictions for each of the intermediate events in the primary 
fault tree are tabulated in Table A1, Intermediate Event Tree Unreliability. The 
unreliability for each of these intermediate events was calculated independently 
of each other so that common, shared intermediate and basic events were not 
duplicated in the calculations. The “Alternator Fails,” is the most common shared 
basic event. 


Intermediate Tree Event 

Unreliability 

% of Total Unreliability 

Loss of Airspeed Information 

5.63x10 7 

0.0% 

Loss of Altitude Information 

2.26x10 3 

8.4% ] 

Loss of Advisory Information 

2.97 xIO 3 

11.1% 

Loss of Attitude Information 

5.16 x 10 5 

r 0.1% 

Loss of Communications Information 

1.05 x 10 2 

39.1% 

Loss of Navigation Information 

1.11 xIO 2 

42.1% 


Table Al. Intermediate Event Tree Unreliability 
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The percentage that each group of information contributes to the unreliability is 
presented in Figure A2, Information Unreliability Percentage Breakdown. As 
depicted, the loss of airspeed and attitude information contribute only a miniscule 
amount - while the communications and navigation information loss combine for 
almost 80% of the unreliability. 

There are two sources for the relative large unreliability displayed by the “Loss of 
Communications and Navigation” information events. 


Figure A2. Information Unreliability Percentage Breakdown 
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One cause of the relatively high unreliability is the low reliability of the 
components in the basic events. The reliability data is presented in Table A2, 
Component Reliability Data. Several of the components feeding into the “Loss 
of Communications and Navigation” intermediate events have relatively low 
reliability. The columns on the right side of the table indicate which “Loss of 
Information, intermediate event is influenced by the individual component (basic 
events). 

The second cause of the high unreliability can be noticed from the fault tree 
representation. The equipment that composes the basic events in the 
intermediate events are all required to function in order for the event not to fail. 
This is the opposite of what is experienced in the “Loss of Attitude, Airspeed, and 
Altitude information intermediate events. In those functions, there were multiple 
ways to get the information. The failure of a particular component or lower 
intermediate event did not automatically cause the failure of the higher 
intermediate event. Airspeed information would have to lose three paths in order 
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to be lost. Although the advisory Panel relied on all of its intermediate and basic 
events, the components involved were relatively reliable. 


[ 

Intermediate Event I 

nfluenced 


Component 

MTBF 

X(/hr) 

Airspeed 

Altitude 

Attitude 

Advisory 

Navigation 

Communications 

ADF Antenna* 

4000 

2.50E-04 





X 


ADF Display* 

19900 

5.03E-05 





X 


ADF Receiver* 

4200 

2.38E-04 





X 


Airspeed Indicator 

18100 

5.52E-05 

X 


X 


X 


Altimeter 

5500 

1.82E-04 


X 

X 




Alternator 

7600 

1.32E-04 

X 

X 

X 

X 

X 

X 

Attitude Indicator 

2500 

4.00E-04 



X 




Clock 

17600 

5.68E-05 


X 

X 

X 

X 


Directional Gyro 

3400 

2.94E-04 



X 


X 


Fuel Quantity 
Indicator 

16500 

6.06E-05 




X 



Fuel Quantity 
T ran^Hi irfir* 

51400 

1.95E-05 




X 



ILS Antenna* 

900 

1.1 IE-03 





X 


II S Display* 

10000 

1.00E-04 





X 


ILS Receiver* 

900 

1.1 IE-03 





X 


Magnetic 

Compass 

19900 

5.03E-05 





X 


Marker Beacon 
Antenna* 

14800 

6.76E-05 





X 


Marker Beacon 
Receiver* 

5300 

1.89E-04 





X 


Oil 

Press ure/T empera 
ture Gauge 

6200 

1.61E-04 




X 



Pitot T ube* 

73600 

1 .36E-05 

X 


X 


X 


Radio (Comm) 
Antenna* 

1200 

8.33E-04 

X 


X 




Radio (Comm) 
Radio* 

900 

1.1 IE-03 

X 


X 




Vacuum Gauge* 

21500 

4.65E-05 



X 

X 



Tachometer 

8400 

1.19E-04 

X 


X 


X 


T ransponder* 

1700 

5.88E-04 

X 


X 



X 

T ransponder 
Antenna* 

9500 

1.05E-G4 

X 


X 



X 

Turn Coordinator 

2100 

4.76E-04 



X 


X 


Vacuum Gauge* 

21500 

4.65E-05 



X 

X 



Vacuum Pump* 

4000 

2.50E-04 



X 




Vertical Speed 
Indicator 

14500 

0 

6.90E-06 


X 

X 




VOR Antenna* 

9600 

1.04E-04 





X 


VOR Display* 

10000 

1.00E-04 





X 


VOR Receiver 

900 

1.1 IE-03 





X 



Table A1. Intermediate Event Tree Unreliability 


This analysis indicates that system which incorporate mechanical components 
experience very high reliability - particularly the airspeed and attitude. This runs 
counter to the expectations that electronic parts are more reliable than 
mechanical parts. There are several major factors, however, that effects this 
result. First, there are several crosschecks for the information. This is similar to 
having built-in redundancy (redundancy being the fundamental method for 
improving reliability in any design). Secondly, the reliability data may not 
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accurately reflect the true reliability. The limited data available may not represent 
a significant sample size. Also, there may be some bias in the data. Data 
collected on aircraft currently in mass production (for quality control objectives) 
may be different from data collected from developmental projects (for design 
validation and verification). 

Another considerable factor is that most of the mechanical instruments do not fail 
in a catastrophic manner. There most common failure mode is to gradually go 
out of specified tolerances. As the item starts to gradually fail, operators will 
notice this and preventive maintenance is performed before actual failure of the 
instrument. These tolerances are also checked during scheduled inspections. 
This analysis did not consider failure modes, only the basic good/failed condition. 

Lastly, the assumption that mechanical parts display an exponential time to 
failure distribution may distort the prediction. The data collected gave no 
indication of their time-to-failure distribution. Without more information from the 
manufacturers on matters such as quality control or environmental control 
factors, it cannot be determined if any distortion of the data may have occurred. 
The exponential time-to-failure distribution assumptions are used to simplify the 
models to a point where an analytical solution exists. 

The results of this analysis indicate that there is approximately a one-in-forty 
chance of losing some portion of the cockpit instrumentation information during a 
six-hour flight. 

Further analysis of the cockpit reliability will require additional data. The limited 
availability of the data needed for this analysis suggests that a new, cohesive 
effort is necessary to collect instrumentation reliability data. 
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Basic Aircraft Instruments 



There are many names used for instruments found in 
a general aviation cockpit. The following instruments 
are used throughout this report. These descriptions 
presented here are meant only for familiarization. 
There are numerous manufacturers of these 
instruments and their appearance may differ from one 
manufacturer to another: however, their basic 


functions are the same. Some models may combine several of these primary 
instruments into one unit. 


Airspeed Indicator 

This instrument tells the pilot the speed at which the 
airplane is flying through the air. This value is 
different from the ground speed because the air 
surrounding the aircraft is affected by the currents 
aloft. 



Attitude Indicator 

Also called the Artificial Horizon, this gyroscopic instrument 
tells the pilot if the airplane is in a nose-high or a nose-low 
attitude; or, if the airplane is banked to the left or to the right. 
This is the basic instrument used to fly in the clouds. 


Altimeter 

The altimeter indicated at what height 
the airplane flies compared to sea 
level. It can be adjusted for changes 
in barometric pressure. 


The Vertical Speed Indicator 

This instrument tells the pilot if the airplane is climbing 
or descending, and if so, at what speed (in feet per 
minute). 
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Heading Indicator 


This is a gyroscopic instrument that is used like a 
compass, only it is more precise and more stable 
during climbs, descents, and turns. It is also called 
a directional gyro. 


Turn Coordinator 

a In a turn, this instrument gives the pilot an indication of the 
rate of turn (how long it will take to turn 180° for example). 
It also includes the ball, that shows if the flight is 
coordinated (symmetrical) or not. 



Tachometer 

This instrument allows the pilot to precisely set the 
engine RPM. 




Engine Gauges 

These gauges are used to monitor engine performance. They 
include oil temperature, oil pressure fuel quantity, engine 
power, and engine temperature. The fuel quantity and oil 
temperature are among the most important ones. 


VOR 


The VHF Omni Range (VOR) is a radio navigation 
instrument. Its Course Deviation Indicator (CDI) 
gives the pilot an indication on the position of the 
airplane in relation to a ground station. The VOR is 
the primary system used to define airways. 
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ILS 

The instrument Landing System is a very sensitive 
VOR that also includes vertical information. It is 
used for precision approaches and landing in bad 
weather conditions. 



ADF 



The needle of the Automatic Direction Finder always points 
towards the ground station on which frequency the receiver is 
operating (acting like an “artificial North pole”). This radio- 
navigation instrument is also called a radio-compass. 


Radios 

There are two kinds of aircraft radios - voice 
transceivers that are used by the pilot to talk with 
Air Traffic Controllers, and radio-navigation 
equipment which are the VOR or ADF receivers. 



T ransponder 


Whenever it is interrogated by a RADAR, the 
transponder sends back a 4-digit code along with 
altitude information. This allows Air Traffic 



Controllers to identify the aircraft displayed as echoes on their RADAR screens. 
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In reliability engineering the mean time to failure (MTTF) is defined by: 


MTTF = E(T) = ]tf(t)dt = ~\R(t)dt Ec l- 1 

0 0 

which is the mean, or expected value of the probability distribution defined by fit). 

Variance, or <7 2 , is the average squared distance a failure time will be from the MTTF. 
It is a measure of spread or dispersion about the mean defined by: 


<x 2 = j(i - MTTF) 2 f (t)dt = j r f (t)dt - (MTTF) 2 Eq. 2 


The standard deviation, cr, has the same units as the mean and is defined by. 

(T = <T Eq.3 

For the exponential distribution, reliability R(t) is defined as: 


R(t) = exp [ j Adt' ] = exp(-A/) 

0 

and the probability density function is defined as: 

/(/) = - clR — = A exp (-At) 
dt 


Eq. 4 


Eq. 5 


Therefore, to define MTTF for the exponential distribution using equations 1 and 4, it is 
found that: 


exp(-Ar) 


MTTF = E(T ) = J R(t)dt = J exp (-A/) = — - 


lo A 


Eq. 6 


Similarly, using equation 2, integration by parts and the results for MTTF, the variance 
for the exponential distribution can be determined: 

a 2 =Jrf(t)dt-(MTTF) 2 =]rexp(-W/-(-jr) 2 =(j) 2 1 

0 0 


Using the results from equations 6 and 7, along with equation 3, it can now be seen that 
for the exponential distribution, 

1 


MTTF = O = - 
A 
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Control System 
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Unreliability, F(t) 
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Unreliability, F(t) 


Hydraulic Probability Plot 
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Unreliability, F(t) 
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Appendix E 
Powerplant System 
Probability Plots 
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Unreliability, F(t) 
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Appendix F 
Electrical System 
Probability Plots 
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Unreliability, F(t) 


Source and Distribution Probability Plot 
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Appendix G 
Weibull 
Failure Law 
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The failure rate or hazard rate function is another probability function that is used in 
reliability. It provides instantaneous (at time t) rate of failure and is defined as follows, 


h(t) = 


m 

R(t) 


where f(t) = probability density function (PDF) = - 


dRji Q 

dt 


and R(t) = reliability function = J / (t')dt' 


For the Weibull distribution, 


(t* 


R(t) = e 


and 


/(') = - 


mt) 

dt 


f£Yi 

K a k a J 


V - 1 




Eq. 1 
Eq. 2 
Eq. 3 

Eq. 4 
Eq. 5 


therefore. 


hit) = 


f R Y 


l 

a 


a 





Eq. 6 


For a system comprised of many components, serial and parallel configurations can be 
used to describe how they relate to each other. If components are in series, they must 
each function for the system to function. If they are in parallel, or redundant, 
configuration, at least one component must function for the system to function. 


Using reliability block diagram for components in series. 





The reliability of the series system following the exponential failure law is defined as. 


r s to = n «, (o = n e ^‘ = Xf ^ 

/= i (=i ' =i 


Eq. 7 
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Where, by using Equation 1, the constant failure rate model can be derived, 



For components governed by the Weibull failure law, the reliability of a system 
comprised of components in series is, 


"s(0 = flm = ne 


Eq. 9 


and from Equation 1 above, the system hazard rate function as governed by the Weibull 
failure law is,- 
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Wei bull Parameter 
Bounds 
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